CVE-2026-20551

Overview

CVE-2026-20551 is a medium‑severity vulnerability in GNSS firmware that allows an out‑of‑bounds write due to a missing bounds check. The flaw can cause a local denial‑of‑service (DoS) without privilege escalation, but requires user interaction to trigger. It is relevant to devices that rely on GNSS for positioning, such as smartphones, automotive systems, and IoT devices.

Description

In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11309305; Issue ID: MSV-10730.

Impact

The vulnerability compromises availability by potentially crashing the GNSS component, leading to loss of positioning services. End users of affected devices may experience intermittent GPS outages or complete loss of navigation. The flaw does not affect confidentiality or integrity, and it requires local user interaction, limiting its impact to the device owner.

Remediation

Apply the vendor‑issued patch identified by ALPS11309305 to fix the bounds check. Verify that the firmware update is successfully installed and that the GNSS driver reports no pending updates. If a patch is not yet available, disable or restrict GNSS functionality until the update is applied.

Risk context

With a CVSS v3 score of 5.5 and no EPSS data, the risk is moderate. Defenders should treat this as a medium‑priority issue and schedule patching accordingly.

Affected products

• Microsoft GNSS driver
• Qualcomm GNSS firmware
• GNSS stack
• GNSS subsystem
• GNSS firmware